IPv6 at Scale

Synopsis #

Operating a larger IPv6 network requires interface addresses, Router Advertisements (RA), Neighbor Discovery (ND), upstream connectivity, and access controls. Use rad(8) with rad.conf(5) for router advertisements and slaacd(8) for client autoconfiguration. Inspect neighbors with ndp(8) and manage interfaces with ifconfig(8) . Define filtering in pf.conf(5) and apply it with pfctl(8) . These procedures apply to campus networks, data centers, and ISP edges with multiple /64s or larger address blocks.

Design Considerations #

  • Prefix plan. Allocate one /64 per L2 segment. For campuses and pods, obtain at least a /56 (256 × /64) or /48 (65,536 × /64) from your provider. Use hierarchical addressing that mirrors your failure domains and routing boundaries.
  • Forwarding model. Route between VLANs; avoid L2 extension across failure domains. IPv6 first-hop redundancy can reuse the CARP pattern from the HA chapter.
  • Router Advertisements. RAs convey on-link prefixes, default gateway, DNS (RDNSS), and search domains (DNSSL). Keep RA timers consistent and advertise the intended /64 prefixes on each L2.
  • ND and ICMPv6. Do not block ICMPv6. Neighbor Discovery, Path MTU Discovery, and error handling depend on it.
  • Prefix Delegation (PD). Upstreams may delegate a /56 or /60 dynamically. Plan how you subdivide and advertise the delegated space to downstream L2s. Review the release notes for OpenBSD 8.0 and dhcp6leased(8) for prefix delegation.
  • NPTv6. Prefer proper routing. Only consider Network Prefix Translation (NPTv6) for constrained renumbering scenarios, and test thoroughly. See pf.conf(5) for current support and caveats.
  • Operations at scale. Standardize RA defaults, centralize logging, and instrument ND tables and error counters per segment. Use change windows to test DAD, RA reception, and PMTU.

Configuration #

The examples assume:

  • Router with interfaces em1 (LAN-A VLAN 10), em2 (LAN-B VLAN 20), em0 (WAN).
  • Assigned aggregate 2001:db8:10::/56, where 2001:db8:10:0010::/64 is LAN-A and 2001:db8:10:0020::/64 is LAN-B.

1) System forwarding and interface addressing (router) #

Enable IPv4/IPv6 forwarding and assign IPv6 addresses to the router’s LAN interfaces.

doas sh <<'ROOT'
printf '%s\n' \
    'net.inet.ip.forwarding=1' \
    'net.inet6.ip6.forwarding=1' \
    >> /etc/sysctl.conf
  # Persist L3 forwarding

sysctl net.inet.ip.forwarding=1 net.inet6.ip6.forwarding=1
  # Apply immediately

cat > /etc/hostname.em1 <<'EOF'
inet6 2001:db8:10:10::1 64
up
EOF
  # LAN-A: router address and prefix length

cat > /etc/hostname.em2 <<'EOF'
inet6 2001:db8:10:20::1 64
up
EOF
  # LAN-B: router address and prefix length

sh /etc/netstart em1 em2
  # Bring the interfaces up now
ROOT

2) Router Advertisements with rad(8) #

Advertise one /64 per L2. Include RDNSS and DNSSL so hosts learn DNS settings via RA.

## /etc/rad.conf — advertise /64s and DNS on two interfaces

# LAN-A (VLAN 10)
interface em1 {
    prefix 2001:db8:10:10::/64
    dns { nameserver 2001:db8:10:10::53
          search example.internal
    }
}

# LAN-B (VLAN 20)
interface em2 {
    prefix 2001:db8:10:20::/64
    dns { nameserver 2001:db8:10:20::53
          search example.internal
    }
}

doas rad -n && doas rcctl enable rad
  # Start at boot
doas rcctl start rad
  # Launch now; begin sending RAs

Keep one advertising router per segment during initial rollout. If you deploy redundant routers with CARP, ensure both run rad(8) and that the virtual default gateway address appears in DNS and documentation.

3) Client autoconfiguration (hosts) #

OpenBSD hosts use slaacd(8) to form addresses from RA. Ensure the interface requests autoconfiguration.

## /etc/hostname.em1 on a host
inet6 autoconf
up

doas rcctl enable slaacd
doas rcctl start slaacd
  # The host will configure a global address and default route from RA

4) PF allowances for IPv6 control-plane and data #

Permit essential ICMPv6, allow LAN traffic, and allow Path MTU Discovery messages. Adjust to your security model as needed.

## /etc/pf.conf — minimal IPv6 allowances

set skip on lo

lan = "{ em1, em2 }"
wan = "em0"

block all

# ICMPv6 is mandatory for ND and PMTU; allow it on all interfaces
pass inet6 proto icmp6 keep state

# Permit LAN IPv6; constrain further per policy
pass in on $lan inet6 from { 2001:db8:10:10::/64, 2001:db8:10:20::/64 } to any keep state

# Outbound to WAN
pass out on $wan inet6 from any to any keep state

# TCP normalization; this does not repair blocked Packet Too Big messages
match in on $wan inet6 scrub (reassemble tcp)

doas pfctl -f /etc/pf.conf
doas pfctl -sr | grep icmp6
  # Verify ICMPv6 allowance is active

5) Upstream integration and Prefix Delegation (overview) #

Use dhcp6leased(8) for DHCPv6 prefix delegation; slaacd handles Router Advertisements. For example, /etc/dhcp6leased.conf can request space on em0 for downstream interfaces:

request prefix delegation on em0 for { em1 em2 }

Review the allocation with dhcp6leased -nvv, enable the upstream interface’s inet6 autoconf flag, and configure rad to advertise the assigned downstream prefixes. Use interface em1 and interface em2 without hard-coded prefix declarations when prefixes should follow interface addresses. Monitor lease changes; do not combine dynamic delegation with the static documentation prefixes above.

After validating /etc/dhcp6leased.conf, enable and start the daemon (disabled by default):

doas dhcp6leased -n && doas rcctl enable dhcp6leased
doas rcctl start dhcp6leased

6) Notes on NPTv6 #

Prefer routed prefixes. PF’s stateful IPv6 address translation is not a claim of RFC 6296 stateless NPTv6 support. Do not treat a nat-to or binat-to rule as an interchangeable implementation of that protocol.

Verification #

  • Addresses and routes: confirm per-L2 /64s and the default route.
ifconfig em1
ifconfig em2 | grep inet6
  # Verify router and host global addresses
route -n show -inet6
  # Confirm default route via the on-link router on hosts; confirm connected /64s on the router
  • Neighbor Discovery: inspect neighbor caches and router entries with ndp(8) .
ndp -an
  # Neighbor and router cache; look for stale or incomplete entries
  • RAs and ND on the wire: capture ICMPv6 on a LAN with tcpdump(8) .
doas tcpdump -ni em1 icmp6
  # Expect Router Advertisements, Neighbor Solicitations/Advertisements
  • DNS via RDNSS: verify that hosts learned DNS servers via RA.
getent hosts www.example.internal
  # Name resolution using learned RDNSS

Troubleshooting #

  • Hosts do not get IPv6 addresses. Confirm rad(8) is running and advertising on the correct interface, net.inet6.ip6.forwarding=1 on routers, and that PF is not blocking ICMPv6. Use tcpdump -ni emX icmp6 to observe RAs.
  • Duplicate Address Detection (DAD) failures. If an address remains tentative or is marked duplicate, check for stray RA senders or misconfigured anycast. Inspect ndp -an for conflicting MACs.
  • Intermittent reachability or stalls. Packet Too Big messages may be blocked. Ensure ICMPv6 is permitted end-to-end and verify PMTU with large pings (ping6 -s).
  • Unexpected router selection. Ensure only the intended routers advertise on each L2. During migrations, disable RA on the retiring router first, then withdraw prefixes.
  • Prefix changes with PD. When the delegated prefix changes, update interface addresses and rad.conf(5) promptly. Automate downstream updates or use deterministic mapping from the delegated aggregate.
  • Firewall denies IPv6. Verify that your policy contains explicit inet6 rules. Mixed inet/inet6 environments often mistakenly permit only IPv4.

See Also #

Report a bug